跟着轩辕之风大佬手写一个抓包软件|第一阶段：解析静态网络数据包文件(收官之战)

import mmap,binascii,time,os,datetime
def big_small_convert(data):  #小端模式转化为大端模式    return binascii.hexlify(binascii.unhexlify(data)[::-1])
def time_stamp_convert(hexstr): #16进制字符串时间戳转化为年月日时分秒  stamp = int(hexstr,16)  timeArray = time.localtime(stamp)  otherStyleTime = time.strftime("%Y-%m-%d %H:%M:%S", timeArray)  return otherStyleTime
def mac_address_format(start,end):  #格式化MAC地址  j = 1  s = ""  for i in range(start,end):    if j % 6 == 0:      s += (m.read(1).hex().upper() + "")    else:      s += (m.read(1).hex().upper() + "-")      j += 1    i += 1  return s
def eth_protocol_identify(start):  #识别以太网帧中type字段所代表的协议类型  type_code = m[start:start + 2].hex()  if type_code == "0800":    s = "IPV4"  elif type_code == "0806":    return "ARP"  elif type_code == "0835":    s = "RARP"  elif type_code == "86dd":    s = "IPV6"  else:    s = "unknow"  return s
def ip_convert(start,end):  #将十六进制ip转换为点分十进制  j = 1  s = ""  for i in range(start,end):    if j % 4 == 0:      hex_num = m.read(1).hex()      num = int(hex_num,16)      s += (str(num) + "")    else:      hex_num = m.read(1).hex()      num = int(hex_num,16)      s += (str(num) + ".")      j += 1    i += 1  return s
def dns_qr_identity(dns_qr_index):   #判断DNS数据包是查询还是响应  result = m[dns_qr_index:dns_qr_index + 1].hex()  result = result[0]  result = bin(int(result,16))[2:]  result = result[0]  return result
def dns_quer_convert(dns_quer_index):  #将对应十六进制段转换为dns查询的域名,                    #返回查询名区域长度末尾(回答区域头部)字节序号和域名  domain = ""  while True:    domain_length = m[dns_quer_index:dns_quer_index + 1].hex()    if domain_length == "00":      break    domain_length = int(domain_length,16)    s = m[dns_quer_index + 1:dns_quer_index + 1 + domain_length].hex()    s = hexstr_to_asciistr(s) + "."    domain += s    dns_quer_index = dns_quer_index + 1 + domain_length  dns_resp_head_index = dns_quer_index + 5
  return [domain,  dns_resp_head_index]
def hexstr_to_asciistr(hexstr):   #将16进制字符串转化为ascii字符串  asciistr = "".join([chr(int(b, 16)) for b in [hexstr[i:i+2] for i in range(0, len(hexstr), 2)]])  return asciistr
def dns_resp_ip_address(dns_answer_rrs_index,dns_resp_head_index):  #读取dns响应包中回答区域中的A记录IP  dns_answer_rrs_number = m[dns_answer_rrs_index:dns_answer_rrs_index + 2].hex()  dns_answer_rrs_number = int(dns_answer_rrs_number,16)  ip_list = []
  for i in range(0,dns_answer_rrs_number):      quer_type_index = dns_resp_head_index + 2      data_length_index = quer_type_index + 8
      quer_type = m[quer_type_index:quer_type_index + 2].hex()      quer_type = int(quer_type,16)      data_length = m[data_length_index:data_length_index + 2].hex()      data_length = int(data_length,16)
      if quer_type == 1:        ip_address_index = quer_type_index + 10        m.seek(ip_address_index)        ip_address = ip_convert(ip_address_index,ip_address_index + 4)        ip_list.append(ip_address)        dns_resp_head_index = data_length_index + 2 + data_length      else:        dns_resp_head_index = data_length_index + 2 + data_length      i += 1  return ip_list

if __name__ == '__main__':  f1 = open("arp.txt",'w')  f2 = open("ip.txt",'w')  f3 = open("udp.txt",'w')  f4 = open("dns.txt",'w')
  start_time = datetime.datetime.now().microsecond  print("开始解析pcap文件,当前时间为: {}".format(start_time))  size = os.path.getsize('day8.pcap')
  with open('day8.pcap','rb') as f:    with mmap.mmap(f.fileno(),0,access = mmap.ACCESS_READ) as m:      type_index = 52  #数据包Ethernet II报文的Type字段字节序号,第一个为52                    total = 0   #记录总数据包数      arp_number = 0  #记录arp协议报文数      ipv4_number = 0 #记录ipv4协议报文数      ipv4_udp_number = 0 #记录ipv4 udp协议报文数      dns_number = 0  #记录ipv4基于udp的dns协议报文数      domain_ip_map = {}  #域名与IP的对应关系
      while True:   #循环遍历数据包        total += 1        protocol_type = eth_protocol_identify(type_index) #识别Ethernet报文中Type字段代表的协议类型        if(protocol_type != "ARP" and protocol_type != "IPV4"):  #若为其他协议则跳到下一个数据包EthernetII报文的Type字段          packet_filed_index = type_index - 20          packet_length = m[packet_filed_index:packet_filed_index + 4].hex()  #读取包头中Caplen(4B)字段          packet_length = big_small_convert(packet_length)  #小端模式转化为大端模式          packet_length = int(packet_length,16)   #16进制转十进制          type_index = type_index + packet_length + 16          if type_index < size:            continue          else:            break
        else:   #若为ARP或IPV4,则先求出时间和包的长度,再分别进入解析          packet_filed_index = type_index - 20  #当前数据包包头中Caplen(4B)字段所在的起始位置          packet_length = m[packet_filed_index:packet_filed_index + 4].hex()  #读取包头中Caplen(4B)字段          packet_length = big_small_convert(packet_length)  #小端模式转化为大端模式          packet_length = int(packet_length,16)   #16进制转十进制
          time_filed_index = type_index - 28          data = m[time_filed_index:time_filed_index + 4].hex()   #读取包头中Timestamp(4B)字段          result = big_small_convert(data)  #小端模式转化为大端模式          standard_time = time_stamp_convert(result)   #16进制字符时间戳转化为年月日时分秒          s = "> - [{}] {} Bytes ".format(standard_time, str(packet_length))
          if (protocol_type == "ARP"):  #若为ARP则进入到ARP协议解析            arp_number += 1
            arp_smac_index = type_index + 10  # 当前数据包目的MAC、源MAC、目的IP、源IP的起始位置            arp_src_ip_index = arp_smac_index + 6            arp_dmac_index = arp_src_ip_index + 4            arp_dst_ip_index = arp_dmac_index + 6            opcode_index = type_index + 8  #ARP包的操作类型字段的起始位置
            m.seek(arp_smac_index)  # 读取目的MAC、源MAC、目的IP、源IP并按格式输出            arp_smac_address = mac_address_format(arp_smac_index, arp_src_ip_index)            arp_src_ip = ip_convert(arp_src_ip_index, arp_dmac_index)            arp_dmac_address = mac_address_format(arp_dmac_index, arp_dst_ip_index)            arp_dst_ip = ip_convert(arp_dst_ip_index, arp_dst_ip_index + 4)
            opcode = m[opcode_index:opcode_index + 2].hex()            opcode = int(opcode,16)
            s_arp = s + "{} {} ".format(arp_smac_address,arp_dmac_address)            if opcode == 1:              # print(s_arp + "查询{}的MAC地址".format(arp_dst_ip))              f1.write(s_arp + "查询{}的MAC地址n".format(arp_dst_ip))            else:              # print(s_arp + "响应{}的MAC地址".format(arp_src_ip))              f1.write(s_arp + "响应{}的MAC地址n".format(arp_src_ip))            type_index = type_index + packet_length + 16  #解析完成,跳到下一个数据包的Ethernet II报文的Type字段            if type_index < size:              continue            else:              break
          else:  #若为IPV4,则进入到IPV4协议报文的解析            ipv4_number += 1            dmac_index = packet_filed_index + 8  #当前数据包包头目的MAC、源MAC的起始位置            smac_index = dmac_index + 6          
            src_ip_index = smac_index + 20            dst_ip_index = src_ip_index + 4
            m.seek(dmac_index)            dmac_address = mac_address_format(dmac_index,smac_index)            smac_address = mac_address_format(smac_index,smac_index + 6)
            m.seek(src_ip_index)            src_ip = ip_convert(src_ip_index,dst_ip_index)            dst_ip = ip_convert(dst_ip_index,dst_ip_index + 4)
            s_ipv4 = s + "{} {} ".format(smac_address,dmac_address)            # print(s_ipv4 + "{} {}".format(src_ip,dst_ip))            f2.write(s_ipv4 + "{} {}n".format(src_ip,dst_ip))
            ipv4_protocol_index = type_index + 11            ipv4_protocol = m[ipv4_protocol_index:ipv4_protocol_index + 1].hex()            ipv4_protocol = int(ipv4_protocol,16)
            if(ipv4_protocol == 17):  #若有UDP协议报文,则继续进入解析              ipv4_udp_number += 1              src_port_index = dst_ip_index + 4              dst_port_index = src_port_index + 2
              src_port = m[src_port_index:dst_port_index].hex()              src_port = int(src_port,16)              dst_port = m[dst_port_index:dst_port_index + 2].hex()              dst_port = int(dst_port,16)
              s_udp = s_ipv4 + "IPV4 {} {} {} {} ".format(src_ip,dst_ip,str(src_port),str(dst_port))              # print(s_udp)              f3.write(s_udp + "n")
              if(src_port == 53 or dst_port == 53): #若有DNS协议报文,则继续进入解析                dns_number += 1                dns_qr_index = dst_port_index + 8                dns_quer_index = dns_qr_index + 10                dns_qr = dns_qr_identity(dns_qr_index)                dns_quer_result = dns_quer_convert(dns_quer_index)                dns_quer_domain = dns_quer_result[0].strip(".")
                if dns_qr == "0":                  s_dns_req = s_udp + "DNS请求 查询域名{}的地址".format(dns_quer_domain)                  # print(s_dns_req)                  f4.write(s_dns_req + "n")                else:                  if dns_quer_domain not in domain_ip_map:                    dns_answer_rrs_index = dns_qr_index + 4                    dns_resp_head_index = dns_quer_result[1]                    dns_resp_ip_list = dns_resp_ip_address(dns_answer_rrs_index,dns_resp_head_index)                    domain_ip_map[dns_quer_domain] = dns_resp_ip_list
                  s_dns_rep = s_udp + "DNS响应 域名{}的地址是{}".format(dns_quer_domain,", ".join(domain_ip_map[dns_quer_domain]))                  # print(s_dns_rep)                  f4.write(s_dns_rep + "n")
                type_index = type_index + packet_length + 16  #DNS协议解析完成,跳到下一个数据包的Ethernet II报文的Type字段                if type_index < size:                  continue                else:                  break              else:                type_index = type_index + packet_length + 16  #若无DNS协议报文,则跳到下一个数据包的Ethernet II报文的Type字段                if type_index < size:                  continue                else:                  break            else:              type_index = type_index + packet_length + 16  #若没有UDP协议报文,跳到下一个数据包的Ethernet II报文的Type字段              if type_index < size:                continue              else:                break      f1.close()      f2.close()      f3.close()      f4.close()  f.close()  end_time = datetime.datetime.now().microsecond  spend_time = end_time - start_time  print("解析结束,结束时间为：{},花费时间为{}us,合{}ms".format(end_time,spend_time,spend_time / 1000))  print("总共{}个数据包,其中ARP协议报文{}个,IPV4协议报文{}个,UDP协议报文{}个,DNS协议报文{}个".format(str(total),        str(arp_number),str(ipv4_number),str(ipv4_udp_number),str(dns_number)))

[C++]Annihilation_choice：未成功运行[Java]橘子🍊：未成功运行第八名：[Python]厉害：11906 ms 11705 ms第七名：[Java]小满同学：5787 ms 5829 ms第六名：[Python]Walker: 1731 ms 1742 ms第五名：[C]letangers: 925 ms 935 ms第四名：[Go]我的朋友叫垃圾呆： 778 ms 794 ms第三名：[Python]Mr.欧谢特 629 ms 631 ms第二名：[C++]endless: 317 ms 318 ms第一名：[C++]月： 146 ms 148 ms

C++大佬：C++本来就很快啊，我代码写得很烂的（太凡尔赛了）Python大佬：花了两天做的优化，挤进前三甲，叫板C++（太强了）C大佬：花时间造轮子，后面没时间做优化了Java大佬：面向对象，封装得太深，运行速度慢了我：Life is short,using python！能跑就行